Ansible: Prepare Windows box connectivity via WinRM
Ansible needs WinRM connectivity in order to run playbooks on windows hosts. It requires https port 5986 to be open and listening. You might also need a self-signed certificate to avoid 401 Not authorized errors.
You will need to perform the following steps:
1. Create Self-signed certificate
Open a powershell and run the following:
New-SelfSignedCertificate -DnsName my.domain.com -CertStoreLocation Cert:\LocalMachine\My
The result will look like this:
Thumbprint                 Subject ----------                 ------- 65C6C9F1B062FE48E53687AA226F6FF1655AFBCC  CN=my.domain.com
2. Start the WinRM listener and configure to use the certificateÂ
winrm create winrm/config/listener?Address=*+Transport=HTTPS '@{Hostname="my.domain.com";CertificateThumbprint="65C6C9F1B062FE48E53687AA226F6FF1655AFBCC";port="5986"}'
3. Allow WinRM traffic through your firewall
New-NetFirewallRule -DisplayName "Windows Remote Management (HTTPS-In)" -Name "Windows Remote Management (HTTPS-In)" -Profile Any -LocalPort 5986 -Protocol TCP
4. Follow the instructions found here:Â http://docs.ansible.com/ansible/intro_windows.html#windows-system-prep
In order for Ansible to manage your windows machines, you will have to enable and configure PowerShell remoting.
To automate the setup of WinRM, you can run this PowerShell script on the remote machine.
The example script accepts a few arguments which Admins may choose to use to modify the default setup slightly, which might be appropriate in some cases.
Pass the -CertValidityDays option to customize the expiration date of the generated certificate.powershell.exe -File ConfigureRemotingForAnsible.ps1 -CertValidityDays 100Pass the -SkipNetworkProfileCheck switch to configure winrm to listen on PUBLIC zone interfaces. (Without this option, the script will fail if any network interface on device is in PUBLIC zone)powershell.exe -File ConfigureRemotingForAnsible.ps1 -SkipNetworkProfileCheckPass the -ForceNewSSLCert switch to force a new SSL certificate to be attached to an already existing winrm listener. (Avoids SSL winrm errors on syspreped Windows images after the CN changes)powershell.exe -File ConfigureRemotingForAnsible.ps1 -ForceNewSSLCert
Note
On Windows 7 and Server 2008 R2 machines, due to a bug in Windows Management Framework 3.0, it may be necessary to install this hotfix http://support.microsoft.com/kb/2842230 to avoid receiving out of memory and stack overflow exceptions. Newly-installed Server 2008 R2 systems which are not fully up to date with windows updates are known to have this issue.
In order to verify the above worked you can perform a winping from your Ansible server... That it!














